Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
CriticalPublic exploit

Zero-click MMS RCE in Samsung Quram Qmage codec

IdentifiersCVE-2020-8899CWE-787· Out-of-bounds Write

CVE-2020-8899 is a heap-based buffer overflow / buffer overwrite vulnerability in Samsung's proprietary Quram Qmage image codec used in Samsung Android devices. The vulnerable codec is integrated into Samsung's graphics stack via Skia/libhwui and processes QMG/Qmage image content. According to the provided content, malformed Qmage images can trigger memory corruption during image parsing/decoding, including in code paths reached automatically by MMS handling. Project Zero research cited in the content showed that incoming MMS messages could cause Samsung Messages to decode the malicious image before the user opened it, creating a zero-click remote attack surface. The issue affects Samsung Android OS versions 8.x, 9.0, and 10.0, with broader context indicating Samsung devices had carried the Qmage codec since approximately 2014. Samsung tracked the issue as SVE-2020-16747 and patched it in May 2020.

Share:
For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows unauthenticated remote code execution on the target Samsung device without user interaction. The provided content states exploitation can occur through a specially crafted MMS message and can yield arbitrary code execution in the context of the vulnerable image-processing path; one cited advisory states code execution may occur at root level, while Project Zero reporting in the provided content states a reverse shell was achieved in the privileges of the SMS/MMS application after bypassing ASLR. In practical terms, exploitation can give an attacker control of the affected process, enabling device compromise, data access, persistence, and potential further privilege escalation depending on the execution context.

Mitigation

If you can’t patch tonight, do this now.

Primary mitigation is prompt patching via Samsung's May 2020 security update. Until patched, reduce exposure by disabling or restricting MMS auto-retrieval/automatic MMS processing where possible, and avoid processing Qmage/QMG images or other untrusted image content from untrusted sources. Because the vulnerable codec is integrated system-wide into image handling, mitigation short of patching is limited.

Remediation

Patch, then assume compromise.

Apply Samsung's May 2020 security update / fixed firmware for affected devices. The content states Samsung released patches in May 2020 for CVE-2020-8899 / SVE-2020-16747. Devices should be updated to the latest vendor-provided security maintenance release that includes the fix.
PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType
GoogleAndroidoperating_system

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.
Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity

Community discussion across Reddit, Mastodon, and other social sources.